About 100 users need to sign PDFs and verify each other's signatures, mostly on shared workstations. I could put individual certificate files on a network share, but I'm not sure that's a good setup.
I'd prefer an on-premises option without a subscription. We occasionally do government work, so cloud services may need extra review.
First pin down who needs to trust the signatures. If employees are signing forms for other employees to check, you can plan around internal certificate trust. If outside organizations need to validate them too, find out what certificates and validation methods they accept before buying anything.
Also check whether people just sign files they already have, or need a way to send signature requests and track responses. Those are related but different workflows.
I'd be cautious about putting everyone's PFX files on a shared drive just because it's convenient. Those files contain private key material, so access controls and how users unlock their own keys matter, especially on shared machines.
Work through issuance, access, replacement and revocation for each user's certificate, not just the signing step. A shared device shouldn't mean a shared signing identity.
Docuseal and Documenso are worth evaluating if you want a self-hosted signing workflow. Check how each handles individual signer identity, certificates and verification before assuming it fits. A document signing certificate for the service is not necessarily the same thing as a certificate for each user.
For regulated work, get the actual signature requirements from whoever owns compliance. MFA and an HSM may be relevant, but whether they're required depends on the rules and the kind of signature involved. If a cloud service comes up for consideration, check the government work restrictions before committing to it.
Answers are reviewed before publication.
Merritly:
The basic workflow is internal: one employee signs a form from a network share and another checks it from a different workstation. Signature requests may be useful too.
c8!gasket_239:
That narrows it down. I'd still check whether any government recipients need to validate the same signatures before settling on an internal-only trust setup.